Telecoms Firms Warned Not to Use Kit and Services from China’s ZTE UPDATE

The National Cyber Security Centre (NCSC) has warned UK telecoms operators against using hardware and services provided by ZTE – a Chinese state-owned enterprise – because of the “potential risks to the UK’s national security.”

The letter to telecoms providers also referenced one of ZTE‘s Chinese rivals, Huawei, although they do not appear to have been similarly blacklisted. A number of operators use related kit, for example, BT makes extensive use of hardware and services supplied by Huawei in their broadband infrastructure and the in 2011 they also signed an R&D partnership with ZTE. The NCSC warned that “adding in new equipment and services from another Chinese supplier [e.g. ZTE] would render our existing mitigations ineffective.”

Dr Ian Levy, Technical Director of the NCSC, said:

“It is entirely appropriate and part of NCSC’s duty to highlight potential risks to the UK’s national security and provide advice based on our technical expertise.

NCSC assess that the national security risks arising from the use of ZTE equipment or services within the context of the existing UK telecommunications infrastructure cannot be mitigated.”

Back in 2013 a report from the government’s Intelligence and Security Committee (ISC) similarly warned that BT’s (Openreach) deployment of broadband ISP and telecoms equipment supplied by Chinese firm Huawei could have “implications for national security” (here), which is despite GCHQ establishing the joint Cyber Security Evaluation Centre (The Cell) with Huawei to examine their equipment. Other operators also make use of telecoms kit from the firms.

At the time GCHQ acknowledged that the “risk of unauthorised access cannot be entirely eliminated“, which is arguably true of any telecoms equipment no matter what its source. “It is just impossible to go through that much code and be absolutely confident you have found everything,” said GCHQ. Suffice to say that mitigating the concern over Huawei is one thing but the resources may not exist to do it for ZTE too.

UPDATE 17th April 2018

Added a comment from BT below.

A BT Spokesperson told ISPreview.co.uk:

“We note the guidance issued by the NCSC with regards to the supply of ZTE equipment to the UK telecommunications sector.

ZTE is just one of many research partners with which BT is engaged around a number of joint projects. Such projects focus on the future uses of networks and technologies and do not necessarily result in the commercial deployment of the research partner’s kit in our network.

BT takes the security of the UK’s critical national infrastructure very seriously and has a robust testing regime in place to ensure that the equipment from all suppliers used in our network remains secure.”